Threats tagged 'ghsa-r4p6-h89w-hg76'

XWEB EVO versions before 5.6.2 have a pre-authentication OS command injection vulnerability. This flaw allows unauthenticated remote attackers to execute arbitrary commands with root privileges by injecting shell metacharacters into the password field. The vulnerability arises from unescaped interpolation of the password into the hashpass invocation in several Lua scripts. The product line reached end of service in March 2026.